了解

了解《数字运营弹性法案》(DORA)

The EU’s Digital Operational Resilience Act (DORA) has applied since January 17, 2025. Financial institutions in the EU must now demonstrate that their ICT risk management, incident reporting, resilience testing, and third-party risk controls operate effectively. In this guide, we’ll break down the basics of DORA, including what it is, why it’s important, and how to support alignment with DORA requirements.

查看解决方案简介

浏览各节

什么是 DORA？

《数字运营弹性法案》是一项欧盟 (EU) 法规，对金融机构及其信息和通信技术 (ICT) 合作伙伴如何管理网络风险作出规定。该法案创建了具有约束力的监督框架，并制定了欧盟金融实体及其服务提供商必须在其 ICT 系统中实施的技术标准。

The European Commission proposed DORA in September 2020. Regulation (EU) 2022/2554 was adopted in December 2022, entered into force on January 16, 2023, and became applicable on January 17, 2025. The European Supervisory Authorities subsequently developed regulatory and implementing technical standards that provide additional detail on areas such as ICT risk management, incident classification and reporting, registers of information, third-party arrangements, resilience testing, and oversight.

所有欧盟成员国需自行负责实施合规要求。 A designated regulator, or “competent authority,” can request entities to take specific security measures and remediate known vulnerabilities.

The European Supervisory Authorities designate critical ICT third-party providers and assign a Lead Overseer. Under the DORA oversight framework, a Lead Overseer may request information, conduct investigations and inspections, issue recommendations, and impose periodic penalty payments in circumstances specified by the regulation. Enforcement measures applicable to financial entities are administered through the relevant competent authorities and national frameworks.

DORA 要求会如何影响您的组织？

DORA applies directly to the financial institutions operating in the EU financial sector, including banks, credit institutions, investment firms, and insurance companies.

It also significantly affects ICT third-party service providers because financial entities must assess provider risk, maintain information about ICT contracts, and include specified provisions in relevant agreements. ICT providers designated as critical by the European Supervisory Authorities are additionally subject to direct EU oversight. 换句话说，任何向欧盟金融部门提供 ICT 系统的技术公司都必须遵守欧盟的法规。 Under DORA, that includes any ICT provider based outside the EU but still operating within its jurisdiction.

A third-country ICT provider is not required to establish an EU subsidiary merely because it supplies services to an EU financial entity. The establishment requirement is connected to the critical-provider oversight regime and should therefore be described only in that context.

DORA applies across the EU financial sector and to the ICT providers that serve it. As a directly applicable EU regulation, it establishes a wide set of operational requirements.

We’ll cover these in more detail later, but at a high level:

涉及的实体必须制定全面的数字运营弹性战略，其中包括网络安全风险评估、业务连续性计划和事件响应协议。
Entities are required to promptly report major ICT-related incidents affecting their digital operations to the relevant competent authority, ensuring a coordinated response across the EU.
金融机构必须管理和监控与其第三方 ICT 提供商相关的风险。这包括进行尽职调查和确保供应商满足合同要求。
各组织必须定期测试运营弹性框架，以发现并解决漏洞。
各实体必须建立治理结构，由高级管理层和董事会负责监督弹性并确保合规性。
DORA 鼓励各组织共享威胁情报和最佳实践，共同加强运营风险管理。

为什么需要 DORA？

金融服务提供商正面临风险。 DORA aims to bolster digital operational resilience in two ways:

大规模解决金融机构的 ICT 风险管理问题
将风险管理法规统一为一个整体框架

以前，欧盟法规主要侧重于确保金融公司有足够的资本来应对运营风险和中断。一些监管机构发布了 ICT 风险管理指南，但它们并不能适用于所有实体。 Plus, they were based on general best practices – not technical standards.

如果没有统一的监督框架，每个欧盟成员国都会发布自己的要求。这使监管法规纷乱如麻，让跨境企业手足无措。

DORA solves this problem with a single, harmonized set of rules that applies to all covered entities regardless of where they operate in the EU.

通过协调金融部门的风险管理，DORA 最大限度地减少了混乱，提高了 ICT 安全、运营风险管理和业务连续性的标准。

What is digital operational resilience?

DORA defines digital operational resilience as a financial entity's ability to build, assure, and review its operational integrity and reliability – ensuring it can continue to deliver services throughout ICT disruptions such as cyberattacks and outages.

连续性在金融领域尤其重要，在金融领域，ICT 系统在消费者访问和管理资金方面起着关键作用。根据 ESMA，金融服务已经严重依赖数字技术来进行日常运营。 That dependency, in turn, has increased cyber risk greatly.

事实上，即使是单一的 ICT 事件也可能让关键基础结构产生重大的连锁反应。如果管理不当，这些风险可能会干扰金融服务的交付，从而影响其他实体、领域甚至整个欧洲经济。

想象一下，如果投资银行的第三方交易平台在拒绝服务攻击期间下线会发生什么。这不仅会破坏最终用户体验，而且还可能使客户在市场上损失大量资金。

更复杂的是，地缘政治事件使经国家支持的攻击者和流氓黑客大肆以金融服务为目标。例如，俄罗斯在乌克兰的战争激发了亲俄网络犯罪分子在 2023 年攻击欧洲投资银行的网络基础结构。幸运的是，该事件仅短暂地影响了该银行网站的可用性。

适用于欧盟数字运营弹性法案 (DORA) 的合规解决方案

了解与影响金融机构及其信息和通信技术 (ICT) 合作伙伴的网络风险相关的欧盟法规，以及 Entrust 如何提供帮助。

查看解决方案简介

DORA 合规性的 5 大支柱

DORA 的综合框架围绕五大支柱构建。 Each addresses a different aspect of digital operational resilience and risk management, but in combination, they form the foundation for a strong and secure financial sector.

1. ICT 风险管理和治理

Per Articles 5-6, management bodies are responsible for defining, approving, overseeing, and remaining accountable for the financial entity’s ICT risk management arrangements.

总体而言，各组织必须建立相应系统，以便在发生 ICT 事件时保持业务连续性。风险管理框架应包括策略、政策、流程和工具，以便保护物理组件和数字基础结构，使其免受未经授权的访问或损害。

Additionally, financial entities within scope are required to:

绘制其 ICT 系统地图，确定提供商之间的关键资产、功能和依赖关系
定期对 ICT 系统进行风险评估，记录、分类网络威胁并为此制定计划
完成业务影响分析，了解严重的中断会如何影响业务运营
实施适当的网络安全措施，例如身份和访问管理 (IAM) 工具、自动威胁检测系统等
Establish business continuity and disaster recovery plans for cyberattacks, service failures, and natural disasters
完成事后总结，从过去的事件中吸取教训并推动持续改进

2. 事件报告

According to Article 17, financial entities must classify ICT-related incidents using the applicable DORA criteria and report major incidents to the relevant competent authority using an initial notification, an intermediate report, and a final report. The detailed content and time limits are specified in Commission Delegated Regulation (EU) 2025/301. financial entities must classify ICT-related incidents using the applicable DORA criteria and report major incidents to the relevant competent authority using an initial notification, an intermediate report, and a final report. The detailed content and time limits are specified in Commission Delegated Regulation (EU) 2025/301.

而且，根据第 18-19 条，组织必须：

Classify ICT-related incidents with the criteria that apply to different impact levels
Create a common template or procedure for reporting incidents to the supervisory authority
Inform end-users and customers about a major incident without delay, primarily if an incident affects clients’ financial interests, and all measures being used to mitigate its consequences

值得注意的是，DORA 要求实体提交三种不同类型的报告：

向管理机构通报的初步报告
用于说明事件解决过程的进展的中间报告
分析事件根本原因及其解决方式的最终报告

3. 数字运营弹性测试

DORA 制定了一些与弹性测试相关的基准要求。 Financial entities must maintain a proportionate, risk-based digital operational resilience testing program. ICT systems and applications supporting critical or important functions must be tested appropriately and at least annually.

Per Articles 25-26, entities must:

制定与其规模、业务和风险状况相匹配的测试计划
包括一系列评估、测试、方法和工具
Follow a risk-based approach, taking into account the evolving landscape of ICT risks
确保测试由独立方进行
对所有发现的问题和漏洞进行优先级排序、分类和全面补救
至少每年对所有关键的 ICT 系统和应用程序执行测试

Additionally, Article 26 states financial entities identified by competent authorities must also conduct advanced threat-led penetration testing at least every three years, unless the competent authority adjusts that frequency.

4. 第三方风险管理

DORA 希望金融公司积极管理其第三方风险格局，并在谈判合同协议时考虑运营弹性。具体而言，DORA 制定了以下有关第三方风险管理的规则：

金融实体必须记录与第三方 ICT 服务提供商的合同协议有关的信息。
Firms must report to competent authorities at least once per year on new arrangements involving ICT services, including the categories of provider and contractual arrangement, as required by the applicable reporting framework.
实体在评估合同时应进行尽职调查（通过识别所有相关风险和潜在的利益冲突）。他们还必须就涉及退出策略、审计和可访问性和安全性能目标的规定进行谈判。
金融实体和 ICT 第三方服务提供商的权利和义务应以书面形式进行分配和规定，且双方均可查阅。
ICT third-party service providers designated as critical by the ESAs are subject to direct oversight from a relevant supervisory authority.
Regulatory Technical Standards (RTS) for subcontracting-chain risks were entered into application on July 22, 2025, and cover precontractual risk assessment, due diligence, implementation, monitoring, and management of subcontracted ICT services supporting critical or important functions.

According to the regulation, entities are discouraged from contracting with ICT companies that fail to meet the appropriate technical standards. 主管机构甚至可以暂停或终止不遵守相关规定的协议。

5. 信息共享

DORA also encourages collaboration among trusted financial entities through voluntary cyber-threat information-sharing arrangements to:

提高对 ICT 相关风险的认识
最大限度限制 ICT 威胁途径的传播
分享防御技术、缓解策略和威胁情报

DORA 与 NIS2

DORA is the sector-specific EU framework for digital operational resilience in financial services, while NIS2 establishes broader cybersecurity obligations across multiple critical sectors. Article 4 of the NIS2 Directive confirms that DORA's provisions apply instead of NIS2 for overlapping requirements – ICT risk management, major-incident reporting, resilience testing, and ICT third-party risk. Organizations should still assess whether other NIS2 provisions or national implementing laws apply to their activities.

According to Article 4 of the NIS2 Directive, DORA’s provisions shall apply instead of those outlined in NIS2. 这意味着 DORA 在金融实体中占优先地位，至少在 ICT 风险管理、事件报告和弹性测试方面是如此。

为满足 DORA 合规性做好准备

DORA sets a high bar for risk management, which requires coordinated governance, operational, technical, and third-party risk-management capabilities. 好在我们可为您提供一条明确的着手路径：

进行差距分析： An initial gap analysis involves assessing the entire company profile from top to bottom, defining its state of cyber maturity and understanding its existing risk management framework. 这项练习将帮助您确定应在多大程度上更新当前流程和步骤。
强制开展 ICT 培训： It’s best to create an ongoing training program for all employees – management included. 领导者应对 DORA 违规行为负责，因此请确保所有人都及时了解最新的 ICT 安全威胁并保持警惕。
审计第三方合同：深入了解合同协议可以帮助您了解与 ICT 提供商的依赖关系。这进一步可让您确定保护这些连接的安全措施并确定其优先顺序。清点所有合同，包括云服务提供商、软件供应商和其他 ICT 系统的合同。然后，确保他们也规定要符合 DORA 要求。
Demonstrate your controls and security measures; don’t just document them. Regulators are looking for organizations to demonstrate that their security measures are working effectively. Documenting your security measures might have been enough to comply before DORA became applicable. Now, organizations must show that the measures documented were implemented and continue to operate effectively.
Implement stronger identity controls internally and with third-party providers.

携手 Entrust 增强网络弹性

满足 DORA 合规性不能听天由命。 Whether you’re a financial entity or an ICT provider, Entrust solutions can help you protect critical infrastructure and support your DORA compliance program.

我们的解决方案包括：

Entrust Cryptographic Security Platform: Unifies management, oversight, and compliance of your cryptographic assets across their lifecycle, bringing together HSMs, PKI, and lifecycle management for keys, certificates, and secrets. CSP Compliance Manager delivers the inventory, risk scoring, and immutable audit trail that support the ICT asset identification and documentation requirements of Article 8.
Hardware security modules (HSMs): Provide a FIPS 140-3 Level 3 certified environment for generating, managing, and protecting cryptographic keys – supporting the key protection measures required under Article 9(4)(d).
身份和访问管理： Entrust Identity as a Service 是一个智能平台，可简化用户身份验证、授权和访问控制。通过安全门户、身份验证等与您的消费者建立联系。
公钥基础结构 (PKI)： Entrust PKI 使用数字证书验证实体和加密数据，帮助提供安全通信和身份验证框架。

准备好开始了吗？欢迎立即联系我们的团队，简化 DORA 合规流程。

联系 Entrust 销售客服